File name:

Eye_Saver-setup-2.48.exe

Full analysis: https://app.any.run/tasks/876a5b9a-d6e2-4cd6-9c6c-25f14818ea61
Verdict: Malicious activity
Analysis date: January 23, 2024, 08:44:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1117FB07571F6DD0E55D4DBF1F0CE908

SHA1:

0ABD501EC96A0994CEADDD0D1299749027648F14

SHA256:

30B56B9AA2CABDE21A9B4A898D4299A7BBCA6235FB5C0EE9939D938CDB20E6B6

SSDEEP:

98304:l02dVzUS+0oNhXdTkXq4BLDXiBPEKPnixdN9d1DUHRHsLkw+OOuaHiVP4iw7o344:9zjfp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Eye_Saver-setup-2.48.exe (PID: 1036)
      • Eye_Saver-setup-2.48.exe (PID: 980)
      • Eye_Saver-setup-2.48.tmp (PID: 2260)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Eye_Saver-setup-2.48.exe (PID: 1036)
      • Eye_Saver-setup-2.48.exe (PID: 980)
      • Eye_Saver-setup-2.48.tmp (PID: 2260)

    • Uses TASKKILL.EXE to kill process

      • Eye_Saver-setup-2.48.tmp (PID: 2260)

    • Process drops legitimate windows executable

      • Eye_Saver-setup-2.48.tmp (PID: 2260)

    • Reads the Internet Settings

      • Eye Saver.exe (PID: 3984)
      • Eye_Saver-setup-2.48.tmp (PID: 2260)

    • Checks Windows Trust Settings

      • Eye Saver.exe (PID: 3984)

    • Reads security settings of Internet Explorer

      • Eye Saver.exe (PID: 3984)

    • Reads settings of System Certificates

      • Eye Saver.exe (PID: 3984)

    • Reads Internet Explorer settings

      • Eye Saver.exe (PID: 3984)

    • Reads Microsoft Outlook installation path

      • Eye Saver.exe (PID: 3984)

    • Reads the Windows owner or organization settings

      • Eye_Saver-setup-2.48.tmp (PID: 2260)

  • INFO

    • Create files in a temporary directory

      • Eye_Saver-setup-2.48.exe (PID: 1036)
      • Eye_Saver-setup-2.48.tmp (PID: 2260)
      • Eye_Saver-setup-2.48.exe (PID: 980)

    • Checks supported languages

      • Eye_Saver-setup-2.48.exe (PID: 1036)
      • Eye_Saver-setup-2.48.tmp (PID: 2404)
      • Eye_Saver-setup-2.48.exe (PID: 980)
      • Eye_Saver-setup-2.48.tmp (PID: 2260)
      • Eye Saver.exe (PID: 3984)

    • Reads the computer name

      • Eye_Saver-setup-2.48.tmp (PID: 2260)
      • Eye_Saver-setup-2.48.tmp (PID: 2404)
      • Eye Saver.exe (PID: 3984)

    • Creates files in the program directory

      • Eye_Saver-setup-2.48.tmp (PID: 2260)
      • Eye Saver.exe (PID: 3984)

    • Creates files or folders in the user directory

      • Eye_Saver-setup-2.48.tmp (PID: 2260)
      • Eye Saver.exe (PID: 3984)

    • Reads the machine GUID from the registry

      • Eye Saver.exe (PID: 3984)
      • Eye_Saver-setup-2.48.tmp (PID: 2260)

    • Checks proxy server information

      • Eye Saver.exe (PID: 3984)
      • Eye_Saver-setup-2.48.tmp (PID: 2260)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 15:27:46+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Leosoft ltd.
FileDescription: Eye Saver Setup
FileVersion:
LegalCopyright:
ProductName: Eye Saver
ProductVersion: 2.48
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start eye_saver-setup-2.48.exe eye_saver-setup-2.48.tmp no specs eye_saver-setup-2.48.exe eye_saver-setup-2.48.tmp taskkill.exe no specs eye saver.exe

Process information

PID
CMD
Path
Indicators
Parent process
980"C:\Users\admin\AppData\Local\Temp\Eye_Saver-setup-2.48.exe" /SPAWNWND=$1600E6 /NOTIFYWND=$8010A C:\Users\admin\AppData\Local\Temp\Eye_Saver-setup-2.48.exe
Eye_Saver-setup-2.48.tmp
User:
admin
Company:
Leosoft ltd.
Integrity Level:
HIGH
Description:
Eye Saver Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\eye_saver-setup-2.48.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1036"C:\Users\admin\AppData\Local\Temp\Eye_Saver-setup-2.48.exe" C:\Users\admin\AppData\Local\Temp\Eye_Saver-setup-2.48.exe
explorer.exe
User:
admin
Company:
Leosoft ltd.
Integrity Level:
MEDIUM
Description:
Eye Saver Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\eye_saver-setup-2.48.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2260"C:\Users\admin\AppData\Local\Temp\is-AU3NV.tmp\Eye_Saver-setup-2.48.tmp" /SL5="$120128,3134541,121344,C:\Users\admin\AppData\Local\Temp\Eye_Saver-setup-2.48.exe" /SPAWNWND=$1600E6 /NOTIFYWND=$8010A C:\Users\admin\AppData\Local\Temp\is-AU3NV.tmp\Eye_Saver-setup-2.48.tmp
Eye_Saver-setup-2.48.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-au3nv.tmp\eye_saver-setup-2.48.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2404"C:\Users\admin\AppData\Local\Temp\is-VOBLF.tmp\Eye_Saver-setup-2.48.tmp" /SL5="$8010A,3134541,121344,C:\Users\admin\AppData\Local\Temp\Eye_Saver-setup-2.48.exe" C:\Users\admin\AppData\Local\Temp\is-VOBLF.tmp\Eye_Saver-setup-2.48.tmp—Eye_Saver-setup-2.48.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-voblf.tmp\eye_saver-setup-2.48.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2452"taskkill.exe" /f /t /im "Eye Saver.exe"C:\Windows\System32\taskkill.exe—Eye_Saver-setup-2.48.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
3984"C:\Program Files\Eye Saver\Eye Saver.exe" --askrestartC:\Program Files\Eye Saver\Eye Saver.exe
Eye_Saver-setup-2.48.tmp
User:
admin
Company:
Leosoft
Integrity Level:
MEDIUM
Description:
Eye Saver
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\eye saver\eye saver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
5 167
Read events
5 096
Write events
65
Delete events
6

Modification events

(PID) Process:(2260) Eye_Saver-setup-2.48.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2260) Eye_Saver-setup-2.48.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2260) Eye_Saver-setup-2.48.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2260) Eye_Saver-setup-2.48.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2260) Eye_Saver-setup-2.48.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2260) Eye_Saver-setup-2.48.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2260) Eye_Saver-setup-2.48.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2260) Eye_Saver-setup-2.48.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3984) Eye Saver.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(3984) Eye Saver.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
12
Suspicious files
4
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
1036Eye_Saver-setup-2.48.exeC:\Users\admin\AppData\Local\Temp\is-VOBLF.tmp\Eye_Saver-setup-2.48.tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
2260Eye_Saver-setup-2.48.tmpC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\WROB4U8N.txttext
MD5:E79714AEBCBAA7E89BFA3D85DC80BB3B
SHA256:59E782E1765FA04B66FF54B601F55EBCC480D5092960FFA8B03DC4441AEFA280
2260Eye_Saver-setup-2.48.tmpC:\Users\admin\AppData\Local\Temp\is-AJJ81.tmp\is-MDBP1.tmpexecutable
MD5:CA41DBA55A727F01104871B160CD5B1D
SHA256:BD173D14A371E6786C4AE90BE1F2C560458D672BA4CBEB3CF55BEBFEF2E2778A
980Eye_Saver-setup-2.48.exeC:\Users\admin\AppData\Local\Temp\is-AU3NV.tmp\Eye_Saver-setup-2.48.tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
2260Eye_Saver-setup-2.48.tmpC:\Program Files\Eye Saver\is-HMAJJ.tmpexecutable
MD5:B3B4E9441545161C660A5B5C5A40FCA0
SHA256:D7C62D836B5421FC95B55E6AA28063A6112D0B7EE7ED0A6DE6A4266CD05DED0B
2260Eye_Saver-setup-2.48.tmpC:\Users\admin\AppData\Local\Temp\is-AJJ81.tmp\NDP452-KB2901954-Web.exeexecutable
MD5:CA41DBA55A727F01104871B160CD5B1D
SHA256:BD173D14A371E6786C4AE90BE1F2C560458D672BA4CBEB3CF55BEBFEF2E2778A
2260Eye_Saver-setup-2.48.tmpC:\Program Files\Eye Saver\updater.exeexecutable
MD5:B6238A1B3E16868EBEC907174191AFA6
SHA256:7D33CCCBA69E5049C5F021AACA337995DE190464CE3F3B132408ED5847A0F4FC
2260Eye_Saver-setup-2.48.tmpC:\Program Files\Eye Saver\is-O5TH1.tmpexecutable
MD5:57B84FAD59F380D600E8DA86475C5787
SHA256:CB8C2397060D07A8A2E8758AFABC5D08289899B67A25EA732485467F526FF865
2260Eye_Saver-setup-2.48.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eye Saver\Eye Saver.lnkbinary
MD5:29C2A0C43BC0E4CA597D22AB14C8C87F
SHA256:E667B8349A35D9E572D48E0D215C2552F2E94937094A91971C3F36B930CCFA37
2260Eye_Saver-setup-2.48.tmpC:\ProgramData\Eye Saver\temp\is-PAU4F.tmptext
MD5:73D43374614C1CE0258F19B56788911F
SHA256:B5915BB04494661733A83448545579BECD472A97C30CE0B751B82D156E2C8481
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2260
Eye_Saver-setup-2.48.tmp
GET
200
188.114.96.3:80
http://www.eye-saver.net/latestversion.txt?3648621774951168
unknown
text
4 b
unknown
3984
Eye Saver.exe
GET
200
188.114.96.3:80
http://www.eye-saver.net/timezone?cid=VOL1-C4BA3647&countryCode=&versionMajor=2&versionMinor=48&ie=11&os=Windows+7&anticache=qhxqr4ic5ghk
unknown
html
8.65 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2260
Eye_Saver-setup-2.48.tmp
188.114.96.3:80
www.eye-saver.net
CLOUDFLARENET
NL
unknown
3984
Eye Saver.exe
188.114.96.3:80
www.eye-saver.net
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
www.eye-saver.net
  • 188.114.96.3
  • 188.114.97.3
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Eye_Saver-setup-2.48.exe